1 package org.cacert.gigi;
3 import java.io.IOException;
4 import java.security.cert.X509Certificate;
6 import javax.servlet.ServletException;
7 import javax.servlet.http.HttpServlet;
8 import javax.servlet.http.HttpServletRequest;
9 import javax.servlet.http.HttpServletResponse;
10 import javax.servlet.http.HttpSession;
12 public class Gigi extends HttpServlet {
14 protected void service(HttpServletRequest req, HttpServletResponse resp)
15 throws ServletException, IOException {
16 X509Certificate[] cert = (X509Certificate[]) req
17 .getAttribute("javax.servlet.request.X509Certificate");
18 HttpSession hs = req.getSession(false);
19 if (hs == null || !((Boolean) hs.getAttribute("loggedin"))) {
21 tryAuthWithCertificate(req, cert[0]);
22 hs = req.getSession(false);
25 if (req.getMethod().equals("POST") && req.getPathInfo() != null
26 && req.getPathInfo().equals("/login")) {
28 resp.sendRedirect("/");
31 if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) {
33 hs.setAttribute("loggedin", false);
37 resp.sendRedirect("/");
41 if (hs == null || !((Boolean) hs.getAttribute("loggedin"))) {
42 resp.setContentType("text/html");
43 resp.getWriter().println("Access denied. Sending login form.");
46 "<form method='POST' action='/login'>"
47 + "<input type='text' name='username'>"
48 + "<input type='password' name='password'> <input type='submit' value='login'></form>");
51 resp.getWriter().println("Access granted.");
54 private void authWithUnpw(HttpServletRequest req) {
55 String un = req.getParameter("username");
56 String pw = req.getParameter("password");
57 // TODO dummy password check if (un.equals(pw)) {
58 HttpSession hs = req.getSession();
59 hs.setAttribute("loggedin", true);
61 private void tryAuthWithCertificate(HttpServletRequest req,
62 X509Certificate x509Certificate) {
63 // TODO ckeck if certificate is valid
64 HttpSession hs = req.getSession();
65 hs.setAttribute("loggedin", true);